Collaboration is key for cloud innovation – Help Net Security

Developers and security professionals work in very different ways. While the former is likely to move and innovate fast – with quick coding and rapid application building a top priority – security teams will often take a more considered approach to ensure costly breaches are avoided and attack surfaces are reduced.

Cloud innovation

The differences between these two IT disciplines are historic, yet as cybersecurity concerns significantly increase and IT infrastructures evolve, the need for closer collaboration has become essential.

For cloud environments, striking the balance between innovation and security is a challenge that must be overcome to ensure organizations can successfully embrace digital transformation. However, with 92% of enterprises implementing a multi-cloud strategy, the cloud environment is becoming increasingly complex, and security is therefore harder to manage.

To optimize the cloud environment, DevOps and SecOps teams must co-operate and embrace the continuing rise of “DevSecOps” – practices that hold everyone accountable for security and a way to ensure it becomes ingrained within the development process from the get-go, rather than an add-on later which becomes a laborious task, or a patched solution after a vulnerability is identified. Security must shift from isolation to collaboration, moving away from a siloed approach to full integration across all business workflows.

There are several ways this can be accomplished, but ultimately, it’s about moving towards a culture of collaborative security and communicating more efficiently across teams. After all, each security analyst, site recovery engineer and developer are working towards the same common goals of innovation, business growth and secure delivery.

Introducing new processes

According to Gartner, DevSecOps will reach mainstream adoption within the next two to five years. Given the increase in cybersecurity threats, the responsibility that developers feel towards security within their organizations has increased, and many have now “shifted left” by introducing security measurements much earlier on in their development process. In fact, it is predicted that by 2022, 90% of DevOps professionals will be adding security into their practices. Yet, while the industry is moving in the right direction, it still has a long way to go.

As differences between SecOps and DevOps have been built up over years, it is unlikely that change will occur naturally on its own. Internal processes must shift and this needs to be championed from the top – by CISOs and business leaders that recognize the changing cybersecurity landscape and understand the holy trinity of people, processes, and technology when it comes to a more innovative and secure workplace.

Investment in security training and awareness for developers is a great place to start and is only possible if key stakeholders recognize its importance. For the developers themselves, they may be proactive in their approach to security, and they will likely be aware of the expanding threat landscape that endangers cloud adoption, but if they are not trained in how to combat these issues, it is impossible to make any significant progress.

The cornerstone to the shift towards better cloud security is communication. By introducing new processes that allow developers to seek security guidance as and when they need it will not only improve the productivity of both teams, but also enable an ongoing conversation that will, in turn, catalyze a culture of collaboration. For example, a security expert could become an integral member to the daily scrum calls between developers to make sure there is always the opportunity to address risk concerns.

Automation and collaboration tools

Technology tools can be better leveraged to help DevOps and SecOps work together more seamlessly. By ensuring that the tools that are being used to bolster cloud security are ones that developers can understand, it will encourage buy-in from DevOps teams to implement security earlier on in the process.

Ultimately, if the SecOps team implements a security tool that clashes with developer needs, it creates the same issues as developers writing or using vulnerable, easily penetrable code and packages. Both teams need to co-exist and identify the tools that will help them work better together, rather than act as a roadblock for more effective collaboration.

Security automation will take the strain off those struggling with an ever-expanding workload and battling against the deluge of false positive alerts. The automated solution will streamline alerting, providing deep and immediate context, thus helping DevSecOps teams get the answers they need faster to perform targeted triage and remediation and effectively pivot back to product development.

While both developers and security professionals play an important role in optimizing the cloud, it is even more essential they work together to guarantee that any innovation is secure. The key here is ensuring that those leading the teams understand the importance of changing their processes in line with the world in which we are now living in. Once this is recognized, new practices can be established that make collaboration feel natural, and enabling technologies can become a perfect foundation for a more cooperative and secure future in the cloud.